Skip to content

Commit bf2d1cc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 242539d commit bf2d1cc

91 files changed

Lines changed: 1028 additions & 238 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/github-reviewed/2022/02/GHSA-v3mr-gp7j-pw5w/GHSA-v3mr-gp7j-pw5w.json‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v3mr-gp7j-pw5w",
4-
"modified": "2022-02-04T17:26:40Z",
4+
"modified": "2026-01-23T21:31:05Z",
55
"published": "2022-02-10T22:33:46Z",
66
"aliases": [],
77
"summary": "Possible SQL injection in tablelookupwizard Contao Extension",
8-
"details": "### Impact\nThe currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.\n\n### Patches\nThe issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/terminal42/contao-tablelookupwizard\n* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)\n",
9-
"severity": [],
8+
"details": "### Impact\nThe currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.\n\n### Patches\nThe issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/terminal42/contao-tablelookupwizard\n* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
1015
"affected": [
1116
{
1217
"package": {
@@ -37,6 +42,10 @@
3742
"type": "WEB",
3843
"url": "https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717"
3944
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/terminal42/contao-tablelookupwizard/2022-02-04-1.yaml"
48+
},
4049
{
4150
"type": "PACKAGE",
4251
"url": "https://github.com/terminal42/contao-tablelookupwizard"
@@ -46,7 +55,7 @@
4655
"cwe_ids": [
4756
"CWE-89"
4857
],
49-
"severity": "HIGH",
58+
"severity": "CRITICAL",
5059
"github_reviewed": true,
5160
"github_reviewed_at": "2022-02-04T17:26:40Z",
5261
"nvd_published_at": null

‎advisories/unreviewed/2022/05/GHSA-89h9-hfwf-446p/GHSA-89h9-hfwf-446p.json‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-89h9-hfwf-446p",
4-
"modified": "2022-05-24T22:00:23Z",
4+
"modified": "2026-01-23T21:30:29Z",
55
"published": "2022-05-24T22:00:23Z",
66
"aliases": [
77
"CVE-2017-18536"
88
],
99
"details": "The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,7 +25,9 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2431
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,

‎advisories/unreviewed/2022/05/GHSA-q43p-2mh4-5jv2/GHSA-q43p-2mh4-5jv2.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q43p-2mh4-5jv2",
4-
"modified": "2022-05-24T19:19:58Z",
4+
"modified": "2026-01-23T21:30:29Z",
55
"published": "2022-05-24T19:19:58Z",
66
"aliases": [
77
"CVE-2021-24767"
88
],
99
"details": "The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2024/01/GHSA-m892-r7q3-ww6c/GHSA-m892-r7q3-ww6c.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m892-r7q3-ww6c",
4-
"modified": "2024-01-11T18:31:22Z",
4+
"modified": "2026-01-23T21:30:29Z",
55
"published": "2024-01-05T06:30:19Z",
66
"aliases": [
77
"CVE-2024-22087"
@@ -22,6 +22,14 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://github.com/foxweb/pico/issues/31"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/foxweb/pico/commit/7a5e4e242121c839cb77f5b9003e735a852f4e58"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/foxweb/pico/commit/e2d172f"
2533
}
2634
],
2735
"database_specific": {

‎advisories/unreviewed/2024/05/GHSA-22j5-63rc-6cq9/GHSA-22j5-63rc-6cq9.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-22j5-63rc-6cq9",
4-
"modified": "2024-05-08T15:30:41Z",
4+
"modified": "2026-01-23T21:30:30Z",
55
"published": "2024-05-08T15:30:41Z",
66
"aliases": [
77
"CVE-2024-31270"
88
],
9-
"details": "Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.\n\n",
9+
"details": "Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2024/06/GHSA-qqfg-j9g4-4mfh/GHSA-qqfg-j9g4-4mfh.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qqfg-j9g4-4mfh",
4-
"modified": "2024-06-18T06:30:43Z",
4+
"modified": "2026-01-23T21:30:30Z",
55
"published": "2024-06-18T06:30:43Z",
66
"aliases": [
77
"CVE-2024-37079"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37079"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2025/02/GHSA-84xh-pwc6-7g4g/GHSA-84xh-pwc6-7g4g.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-84xh-pwc6-7g4g",
4-
"modified": "2025-11-12T15:31:27Z",
4+
"modified": "2026-01-23T21:30:33Z",
55
"published": "2025-02-05T18:34:46Z",
66
"aliases": [
77
"CVE-2025-23419"
@@ -39,7 +39,8 @@
3939
"database_specific": {
4040
"cwe_ids": [
4141
"CWE-287",
42-
"CWE-613"
42+
"CWE-613",
43+
"CWE-863"
4344
],
4445
"severity": "MODERATE",
4546
"github_reviewed": false,

‎advisories/unreviewed/2025/05/GHSA-h2mm-jj4p-hm2p/GHSA-h2mm-jj4p-hm2p.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h2mm-jj4p-hm2p",
4-
"modified": "2026-01-23T15:31:34Z",
4+
"modified": "2026-01-23T21:30:35Z",
55
"published": "2025-05-22T00:34:03Z",
66
"aliases": [
77
"CVE-2025-34026"
88
],
99
"details": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/09/GHSA-9c77-w28p-48g4/GHSA-9c77-w28p-48g4.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9c77-w28p-48g4",
4-
"modified": "2025-11-03T18:31:38Z",
4+
"modified": "2026-01-23T21:30:36Z",
55
"published": "2025-09-05T18:31:16Z",
66
"aliases": [
77
"CVE-2025-38706"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()\n\nsnd_soc_remove_pcm_runtime() might be called with rtd == NULL which will\nleads to null pointer dereference.\nThis was reproduced with topology loading and marking a link as ignore\ndue to missing hardware component on the system.\nOn module removal the soc_tplg_remove_link() would call\nsnd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored,\nno runtime was created.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-476"
66+
],
67+
"severity": "MODERATE",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-09-04T16:15:39Z"

‎advisories/unreviewed/2025/09/GHSA-wrfw-2xr6-c3p7/GHSA-wrfw-2xr6-c3p7.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wrfw-2xr6-c3p7",
4-
"modified": "2025-11-03T18:31:38Z",
4+
"modified": "2026-01-23T21:30:35Z",
55
"published": "2025-09-05T18:31:16Z",
66
"aliases": [
77
"CVE-2025-38702"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fix potential buffer overflow in do_register_framebuffer()\n\nThe current implementation may lead to buffer overflow when:\n1. Unregistration creates NULL gaps in registered_fb[]\n2. All array slots become occupied despite num_registered_fb < FB_MAX\n3. The registration loop exceeds array bounds\n\nAdd boundary check to prevent registered_fb[FB_MAX] access.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -44,8 +49,10 @@
4449
}
4550
],
4651
"database_specific": {
47-
"cwe_ids": [],
48-
"severity": null,
52+
"cwe_ids": [
53+
"CWE-787"
54+
],
55+
"severity": "HIGH",
4956
"github_reviewed": false,
5057
"github_reviewed_at": null,
5158
"nvd_published_at": "2025-09-04T16:15:38Z"

0 commit comments

Comments
 (0)